RE: how broken are antivirus products?

OTOH there is no excuse whatsoever for the practice that the major AV industry players now indulge of not acknowledging the existence of a new infection until they can detect it. This was particularly irritating in the case of the Brasil variant of Opaserv. Only Trend and Kapersky had it identified by the time we were infected, and both of them had classified it "not found in wild". CA, NA, and Symantec didn't acknowledge it's existence for at least 1 full day. In the case of NAV, it was nearly 3 working days from our infection that they had it on their "active" list and published a signature that detected it. Wild lists and virus dictionaries are of little value when they are perverted into marketing tools. S.

                                                                                                           
                      Harley David                                                                         
                                     cc:                                                         
                                               Subject:  RE: how broken are antivirus products?            
                      11/22/2002 01:10                                                                     
                      PM                                                                                   
                                                                                                           
                                                                                                           

The anti-virus industry -does- keep its samples to itself. Industry-standard testing is very stringent and the methodology -is- somewhat under-documented. And yes, it -is- very difficult for an independent researcher to get into the charmed circle. I think there probably is an element of defensive obstructionism and preserving the mystique sometimes. <snip> Received on Tue Nov 26 14:29:13 2002